rmhrisk

A recent incident in the Mozilla CA Program put this on public display and three root programs pushed back. The pattern isn't unique to PKI. It's just uniquely visible there.

unmitigatedrisk.com?p=1123

"Within 24 hours" becomes "promptly." Profiles become "per industry standards." Each edit is defensible. Taken together, they produce documents that can't be meaningfully audited.

⬇️

There's a pattern that plays out across every regulated industry. Requirements increase. Complexity compounds. And instead of building capacity to meet the rising bar, organizations quietly lower the specificity of their commitments.

⬇️

Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices.

projectzero.google/2026/01/pixe...

6-day and IP Address Certificates are Generally Available Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a short-lived certificate subscr...

This is what zero-trust looks like at the infrastructure layer. Identity and encryption match the lifetime of the thing being secured.

If your certificate strategy still assumes stable names and year-long validity, it is already behind reality.

letsencrypt.org/2026/01/15/6...

Short-lived and IP certificates make it possible to use TLS before a DNS name exists, reduce friction for DNS over HTTPS adoption, secure ephemeral devices and services by default, and shift trust from long-lived credentials to automated renewal.

👇

Short-lived and IP address certificates are now generally available from Let’s Encrypt.

Modern infrastructure no longer has stable hostnames, static IPs, or long-lived trust anchors. Workloads spin up before DNS exists, live briefly, and disappear. Trust has to keep up.

👇

TL;DR we've constructed an entire compliance industry around optimizing metrics that have become disconnected from the underlying reality they were supposed to measure.

In complex systems, oversight that depends on snapshots will fail predictably. Data without continuous interpretation does not produce safety.

Regulators oversee continuously changing systems using periodic exams. That mismatch is structural.

SVB wasn’t a surprise. Regulators had leading indicators and documented findings. Risk accumulated while interpretation and enforcement lagged.

The whole premise of a compliance team governing complex systems they barely understand is broken. Compliance in a complex system has to be a continuous team sport, a natural byproduct of the way teams work. Not an annual bolt-on.

The same will be true everywhere. Scale and velocity outpace our ability to reason. The audit still passes. The gap just grows faster.

Now consider that AI is writing 30% of the code at Google and Microsoft. The humans who understood what the system does, and whether it matches what the policy claims, understand less every quarter.

Enron passed their audits. Wirecard passed their audits. Every distrusted CA passed their audits. Auditors are paid to confirm compliance, not to find problems. When the measure becomes the target - and the measurer is incentivized to pass you - it stops measuring anything.

GitHub - FiloSottile/age: A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability. A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability. - FiloSottile/age

Really big age release coming tomorrow! 🎅🏻

- native post-quantum keys
- built-in recipients for hw plugins
- age-inspect tool
- plugin framework
- batchpass plugin
- many improved error messages

PLCs on the internet -> MCP servers on the internet.
Evolution happened. Learning didn’t.
We’re rebuilding ICS - this time with agency!

Building a Transparent Keyserver Today, we are going to build a keyserver to lookup age public keys. That part is boring. What’s interesting is that we’ll apply the same transparency log technology as the Go Checksum Database to keep the keyserver operator honest and unable to surre...

Key Transparency is the unsung hero of E2E encryption, the essential but often overlooked until you're deep in implementation. @FiloSottile's been working on a transparency-log-based approach that's worth your attention: blog.transparency.dev/building-a-t...

I wrote up some thoughts on how we got here: unmitigatedrisk.com?p=1116

The GRANITE Act, which tries to rein in extraterritorial overreach in tech regulation, got me thinking.👇

Attestation, What It Really Proves and Why Everyone Is About to Care unmitigatedrisk.com?p=1114

Congressional Budget Office confirms it was hacked | TechCrunch The congressional research office confirmed a breach, but did not comment on the cause. A security researcher suggested the hack may have originated because CBO failed to patch a firewall for more tha...

NEW: The U.S. Congressional Budget Office was hacked.

@doublepulsar.com found that the cause may be an unpatched Cisco ASA firewall. I asked CBO about that but it did not respond to the question.

techcrunch.com/2025/11/07/c...

I also use this as a kind of low pass filter. It’s reasonable to expect a security leader to understand the concepts behind the systems they protect. You don’t need to be an expert to grasp the abstract properties; it’s an opportunity to practice humility and curiosity as well.

I hired a director recently and this was my screening question: can you please explain the difference between public-key and symmetric-key cryptography.

Virtually all the candidates, who universally claimed security engineering expertise of some kind (some cryptography-related) could not. At all.

Some thoughts on that here: unmitigatedrisk.com?p=1109

AI can lift human dignity by opening doors to more people and adapting to how we think, letting us focus on what matters. But only if we design it right and keep monitoring its work. 👇

Satellites Are Leaking the World’s Secrets: Calls, Texts, Military and Corporate Data With just $800 in basic equipment, researchers found a stunning variety of data—including thousands of T-Mobile users’ calls and texts and even US military communications—sent by satellites unencrypte...

Researchers pointed a satellite dish at the sky for 3 years and monitored what unencrypted data it picked up. The results were shocking: They obtained thousands of T-Mobile users' phone calls and texts, military and law enforcement secrets, much more: www.wired.com/story/satell... 🧵👇

No a few years ago they switched to their own root store. They do pull in certificates that the user adds but not the platform root store.

Full analysis here → unmitigatedrisk.com?p=1092

The bigger issue? Microsoft’s root program still trusts this CA, leaving Edge and Windows users exposed in ways Chrome, Firefox, and Safari users aren’t.

The pattern is familiar: long-lived trust, weak oversight, systemic risk. It’s time for Microsoft to step up and fund proper root governance.

👇

This morning, a serious WebPKI incident surfaced: a tiny CA misissued certificates for 1.1.1.1 - Cloudflare’s DNS service.

With BGP hijacks happening regularly, those certs could enable full man-in-the-middle attacks.

👇